Github token demanding while "composer install/update"

[badmansan]

1) composer create-project yii2-starter-kit/yii2-starter-kit myproject.com 2) cd ./myproject.com 3) composer require --dev roave/security-advisories:dev-master ....a lot of time has passed....

Your GitHub credentials are required to fetch private repository metadata (https://github.com/npm/npm-normalize-package-bin.git) Head to https://github.com/settings/tokens/new?scopes=repo&description=Composer+on+comp+2019-12-12+1133 to retrieve a token. It will be stored in "C:/Users/user/AppData/Roaming/Composer/auth.json" for future use by Composer. Token (hidden):

I have only one token and it already in global composer config, so I press 'enter'

No token given, aborting. You can also add it manually later by using "composer config --global --auth github-oauth.github.com "

Installation failed, reverting ./composer.json to its original content.

[RuntimeException] Failed to execute git clone --mirror "git+https://github.com/vibornoff/asmcrypto.js" "C:/Users/user/AppData/Local/Composer/vcs/git-https---github.com-vibornoff-asmcrypto.js/"

Cloning into bare repository 'C:/Users/user/AppData/Local/Composer/vcs/git-https---github.com-vibornoff-asmcrypto.js'... git: 'remote-git+https' is not a git command. See 'git --help'.

I try it in win7, php 7.2.22, composer 1.9.1 (latest at now). By the way, https://github.com/npm/npm-normalize-package-bin.git give 404. Any ideas how to fix it?

[rivieiraa]

Try adding --no-plugins option at the end of your composer require command

[XzAeRo]

Your GitHub credentials are required to fetch private repository metadata (https://github.com/npm/npm-normalize-package-bin.git)

This is complaining about a package that is indeed private, and asking your credentials to access said repository.

I may suggest to run your composer require command with the following flags:

composer require roave/security-advisories:dev-master --dev --prefer-dist -o --no-plugins

And, then run:

composer install --prefer-dist -o

The last composer installis used to generate the Yii2 Extensions plugin php file in vendor, since the --no-plugin option doesn't generate such file, but speeds up the whole update.

[rivieiraa]

https://getcomposer.org/doc/articles/autoloader-optimization.md#autoloader-optimization

Not sure if it is relevant, but docs saying we should not run optimizations during development. But its good to know we actually can optimize autoloading. Yay

[badmansan]

composer require --dev roave/security-advisories:dev-master --no-plugins --prefer-dist give me

./composer.json has been updated Loading composer repositories with package information Updating dependencies (including require-dev) Dependency resolution completed in 0.006 seconds Your requirements could not be resolved to an installable set of packages.

Problem 1

• roave/security-advisories dev-master conflicts with symfony/http-foundation[v3.4.21].
• roave/security-advisories dev-master conflicts with symfony/http-foundation[v3.4.21].
• roave/security-advisories dev-master conflicts with symfony/http-foundation[v3.4.21].
• Installation request for roave/security-advisories dev-master -> satisfiable by roave/security-advisories[dev-master].
• Installation request for symfony/http-foundation (locked at v3.4.21) -> satisfiable by symfony/http-foundation[v3.4.21].

Installation failed, reverting ./composer.json to its original content.

so i need to run composer update --no-plugins --prefer-dist first, then composer require roave/security-advisories:dev-master --dev --prefer-dist --no-plugins run with out errors

in future --no-plugins must be always in composer param while require/update?